fix(auth): restore /echo prefix after proxy strips it from next param

The reverse proxy strips /echo/ before Python, so next=/workspace.html.
Both the JS redirect and the server-side already-logged-in path now
prepend /echo to produce a valid public URL.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dashboard/login.html

@@ -257,8 +257,11 @@
                         // relative /echo/ path to prevent open-redirect attacks.
                         var params = new URLSearchParams(window.location.search);
                         var next = params.get('next') || '';
-                        var dest = (next && /^\/echo\/[^/]/.test(next) && next.indexOf('/echo/login') !== 0)
-                            ? next
+                        // The proxy strips /echo/ before Python, so `next` is
+                        // e.g. "/workspace.html". Re-add the /echo prefix for
+                        // the browser. Guard against open-redirect (no ://).
+                        var dest = (next && /^\/[^/]/.test(next) && next.indexOf('://') === -1)
+                            ? '/echo' + next
                             : '/echo/workspace.html';
                         window.location.assign(dest);
                         return;